Skip to content

Commit 072754d

Browse files
committed
Merge #141: Drop no longer required gitian-verify.py
0a17698 Drop no longer required `gitian-verify.py` (Hennadii Stepanov) Pull request description: The last gitian built version, which is 0.21, has reached its [EOL](https://bitcoincore.org/en/lifecycle/). ACKs for top commit: fanquake: ACK 0a17698 Tree-SHA512: ebba97594469ac24cf33a0b1865bbbc8ac2d6c17fa910f399ae647b4a76fca58c754182a809e13a9d4a8e8e65a3e4d33483a7bfafd1d9419998329c20e2f3fe1
2 parents 1bbb9ba + 0a17698 commit 072754d

File tree

2 files changed

+17
-378
lines changed

2 files changed

+17
-378
lines changed

README.md

Lines changed: 17 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -279,39 +279,37 @@ Make a new release tag, performing a few checks.
279279

280280
Usage: `make-tag.py <tag>`.
281281

282-
gitian-verify
283-
-------------
282+
guix-verify
283+
-----------
284284

285-
A script to verify gitian deterministic build signatures for a release in one
286-
glance. It will print a matrix of signer versus build package, and a list of
287-
missing keys.
285+
A script to verify guix deterministic build signatures for a release in one
286+
glance. It will print a matrix of signer versus build package ("noncodesigned"
287+
and "all"), and a list of missing keys.
288288

289-
To be able to read gitian's YAML files and verify PGP signatures, it needs the
290-
`pyyaml` and `gpg` modules. This can be installed from pip, for example:
289+
To be able to verify PGP signatures, it needs the `gpg` modules. This can be
290+
installed from pip, for example:
291291

292-
```bash
293-
pip3 install --user pyyaml gpg
292+
```sh
293+
pip3 install --user gpg
294294
```
295-
(or install the distribution package, in Debian/Ubuntu this is `python3-yaml` and `python3-gpg`)
296295

297-
The `gpg` module requires the [gpgme](https://www.gnupg.org/software/gpgme/index.html) library
298-
which is usually present on Linux, and can be installed with `brew install gpgme` on macOS.
296+
(or install the distribution package, in Debian/Ubuntu this is `python3-gpg`).
299297

300-
Example usage: `./gitian-verify.py -r 0.21.0rc5 -d ../gitian.sigs -k ../bitcoin/contrib/builder-keys/keys.txt`
298+
Example usage: `./guix-verify.py -r 24.0 -d ../guix.sigs -k ../bitcoin/contrib/builder-keys/keys.txt`
301299

302300
Where
303301

304-
- `-r 0.21.0rc5` specifies the release to verify signatures for.
302+
- `-r 24.0` specifies the release to verify signatures for.
305303
- `-d ../gitian.sigs` specifies the directory where the repository with signatures, [gitian.sigs](https://github.com/bitcoin-core/gitian.sigs/) is checked out.
306304
- `../bitcoin/contrib/builder-keys/keys.txt` is the path to `keys.txt` file inside the main repository that specifies the valid keys and what signers they belong to.
307305

308306
Example output:
309307
```
310-
Signer linux osx-unsigned win-unsigned osx-signed win-signed
311-
justinmoon No Key No Key No Key No Key No Key
312-
laanwj OK OK OK OK OK
313-
luke-jr OK OK OK OK OK
314-
marco - OK OK OK OK
308+
Signer noncodesigned all
309+
0xb10c No Key -
310+
achow101 OK OK
311+
benthecarman No Key -
312+
...
315313
316314
Missing keys
317315
norisg 3A51FF4D536C5B19BE8800A0F2FC9F9465A2995A from GPG, from keys.txt
@@ -328,18 +326,6 @@ The following statuses can be shown:
328326
- `Bad` Known key but invalid PGP signature.
329327
- `Mismatch` Correct PGP signature but mismatching binaries.
330328

331-
guix-verify
332-
-----------
333-
334-
A script to verify guix deterministic build signatures for a release in one
335-
glance. It will print a matrix of signer versus build package ("noncodesigned"
336-
and "all"), and a list of missing keys.
337-
338-
Arguments and usage are the same as gitian-verify except that you don't need the `pyyaml`
339-
module for this one.
340-
341-
Example usage: `./guix-verify.py -r 23.0rc2 -d ../guix.sigs -k ../bitcoin/contrib/builder-keys/keys.txt`
342-
343329
ghwatch
344330
-------
345331

0 commit comments

Comments
 (0)